Your information deserves care too.

1. About this policy

Clea Mental Health Pty Ltd, trading as Clea, is an Australian healthcare navigation business. In this policy, “Clea”, “we”, “us” and “our” refer to Clea Mental Health Pty Ltd.

This policy explains how we handle personal information when you use Clea, including our website, member account, Care Profile, AI Concierge, provider discovery, clinic handoff, booking, support, newsletter and related services.

Health information is sensitive information under Australian privacy law. We treat it accordingly.

2. What information we collect

Depending on how you use Clea, we may collect:

• account information such as your name, email address, login details and profile information;
• Care Profile information you choose to provide, including symptoms, care goals, age group, migraine history, previous care, treatment history, referral information, postcode, access preferences and timing preferences;
• My Migraine information you choose to record, including headache and migraine-like days, severity, dizziness, aura, acute medicine use, functional impact, notes and structured treatment history;
• saved resources, followed topics and structured treatment experiences you submit to Clea, including optional self-reported migraine frequency and symptom-pattern labels;
• booking and handoff information, including the provider you choose, appointment preferences, booking status and clinic communications recorded through Clea;
• support and AI Concierge questions and the responses provided through the service;
• feedback about the non clinical Clea and booking experience;
• optional care journey outcome feedback, such as whether an appointment happened, how prepared you felt, whether Clea navigation was useful and whether your next step felt clear;
• provider experience ratings you choose to submit, including 1–5 clinician and clinic scores, whether you confirm you personally attended care, and verification information such as a completed Clea booking or internal verification status;
• newsletter information such as your email address, optional mobile number, consent choices and source attribution;
• meal-planner delivery details when you choose to email yourself a plan. Clea uses the email address to deliver that plan and stores a one-way email hash for short-term abuse prevention; signing up for The Migraine Brief is a separate optional consent;
• investor or strategic-party data room requests, including your name, work email, firm, role, investor type, profile link, typical cheque information and request message where you choose to provide them;
• enterprise, payer, employer, clinic-group or research-partner enquiries, including organisation details, proposed use cases, study details and contact information you choose to submit;
• clinic and provider information supplied by participating healthcare organisations; and
• first party product events used to understand Clea journeys and improve the service, such as completion of the symptom navigator, use of Ask Clea, saves, follows, shares and feature engagement; and
• security and audit events about high-value actions such as data exports, clinic booking changes, administrative content/provider changes and use of selected AI workflows. Clea aims to keep unnecessary health content out of audit metadata; and
• technical information needed to operate and secure the service, such as device, browser, session, security and basic usage information.

We do not require you to provide more health information than is reasonably necessary for the Clea service you choose to use.

3. How we collect information

We primarily collect information directly from you when you create an account, complete a Care Profile, ask Clea Concierge a question, request a handoff or booking, contact support, build and email a migraine meal plan, join The Migraine Brief, request investor data room access, or otherwise use the service.

We may also receive limited information from participating clinics and providers about bookings, availability and service information, and from technology providers that help us operate, secure and measure the service.

4. Why we use your information

We use personal information where reasonably necessary to:

• create and operate your Clea account and Care Profile;
• apply practical navigation filters and show provider information relevant to the pathway and preferences you selected;
• provide AI Concierge and human support for healthcare navigation questions;
• carry out a clinic handoff or booking that you expressly request;
• verify provider experience ratings, prevent rating manipulation and publish deidentified aggregate clinician and clinic scores once Clea’s minimum verified-response threshold is met;
• send transactional messages about your account, booking, appointment, emailed meal plan or requested service;
• review investor or strategic-partner data room requests, issue expiring access links, manage diligence access and communicate about Clea fundraising or strategic discussions where appropriate;
• review enterprise or research partnership enquiries and assess whether a proposed pilot, recruitment program or collaboration is appropriate for Clea;
• operate, secure, troubleshoot and improve Clea;
• prevent misuse, fraud and security incidents;
• meet legal and regulatory obligations; and
• send marketing only where we have the required consent or another lawful basis.

We do not sell your health information. We do not allow provider payment to buy a clinical ranking or a claim that a provider is the best clinician for you. We do not use Care Profile health information for targeted advertising.

Optional treatment-experience labels are used to show aggregate experiences for the group a visitor selects. A subtype-specific score is published only when that exact group has at least five people who report having tried the treatment. These are self-reported experiences, not verified diagnoses or clinical-effectiveness measures. Historical entries without labels are not assigned a subtype by AI. Your own treatment-experience information is included in your account data export.

5. Sensitive health information and consent

When you choose to save a Care Profile, Clea asks for your consent to store and use the health information you entered for the purposes described at collection and in this policy.

If you choose to connect or import health information from Apple Health, Health Connect, a FHIR record, Migraine Buddy or another health application, Clea stores the imported information and its source provenance in your private account so it can be organised alongside information you record directly in Clea. Connecting or importing a source does not by itself share that information with a clinic, pharmacy or other provider.

Clea's public MCP / AI-assistant tools use public Clea information only. Connected health information and private My Clea records are not exposed through those public tools. If Clea later offers authenticated AI-assistant access to private records, that access will require a separate account connection, explicit permissions and scoped authorisation.

If you provide information about a child or another person, you confirm that you are their parent, guardian or are otherwise authorised to provide that information and make the relevant decisions on their behalf.

You can choose not to provide optional information, although this may reduce the usefulness of some navigation features.

6. AI Concierge

Clea Concierge uses artificial intelligence to help with practical healthcare navigation, such as explaining provider types, referral logistics, care pathways, booking questions and how Clea works.

To provide a relevant response, Clea may process your question together with Clea context associated with your authenticated account, such as your Care Profile, recent My Migraine records, treatment history, saved or followed topics and upcoming Clea bookings. Clea uses this context to organise and explain information you recorded; it is instructed not to infer diagnosis or causation from those records. We use technology providers to process this information on our behalf under service and security arrangements.

Clea Concierge does not diagnose a condition, prescribe treatment, recommend a medicine, determine clinical eligibility or replace a qualified healthcare professional. If a question falls outside its navigation role, Clea may direct you to an appropriate clinician, healthdirect, emergency care, or human support.

Clea may also use AI to triage community posts and replies for potential safety, misinformation, prescription/dosing instructions, medicine sales, harassment, promotion or privacy risks. AI triage is not the final moderation decision: content may be flagged or temporarily held for a human moderator, who decides whether it remains published.

7. Clinic handoffs and bookings

A participating clinic does not receive your Care Profile merely because it appears in Clea.

When you expressly request a handoff or booking, Clea may make the selected information necessary for that request available to the chosen clinic. That clinic then handles the information it receives in accordance with its own legal and professional obligations.

Provider accounts are designed so clinics can access only the Clea records that are authorised for their service, not unrelated member profiles.

7A. Provider experience ratings

Members may choose to rate their experience with a clinician and clinic out of five. Ratings submitted after a completed Clea booking can be verified automatically. Ratings about care received outside Clea may be held until Clea verifies the care relationship.

Public ratings are shown as deidentified aggregates only after enough verified patient experiences exist. Clea does not publish your identity with a rating through this feature and does not collect a public written review as part of the star-rating flow.

Provider payment does not change ratings, suppress a low rating or buy a higher clinical position.

8. Who we may disclose information to

We may disclose personal information where reasonably necessary to:

• the participating clinic or provider you ask Clea to contact;
• cloud hosting, database, authentication, email, push notification, analytics, AI, security and other technology providers that support Clea;
• professional advisers, insurers, auditors and service providers where appropriate;
• government, regulators, courts or law enforcement where required or authorised by law; and
• a successor or purchaser in connection with a genuine corporate transaction, subject to appropriate confidentiality and privacy protections.

We do not provide member health information to clinics for prospecting or unrelated marketing.

9. Overseas processing

Some technology providers used by Clea may process or store personal information outside Australia, including in the United States and other locations where those providers operate.

Where Australian privacy law requires it, we take reasonable steps in relation to overseas handling and disclosure of personal information.

10. Marketing, email and SMS

Joining The Migraine Brief is separate from creating a Care Profile. Newsletter membership does not require you to provide health information.

We ask separately for email marketing consent and optional SMS consent. You can unsubscribe from marketing at any time. We will action unsubscribe requests in accordance with applicable Australian spam laws.

Transactional messages about an account, booking, security or service request are different from marketing messages. We aim to keep promotional content separate from essential service communications.

11. Analytics and device storage

Clea uses limited first party analytics and product events to understand use of the service, measure product journeys and retention, remember necessary settings, attribute acquisition sources and maintain security. We aim to minimise device storage and do not use Care Profile or My Migraine health information for advertising profiles.

For public MCP / AI-assistant access, Clea may record which Clea tool was called and aggregate usage measures. We do not intentionally store the raw health question in that product-analytics event.

Clea also keeps security and operational audit records for selected high-value actions. These records are used for security, access review, incident investigation, governance and corporate diligence rather than advertising.

12. Security and retention

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These measures include authenticated access, scoped provider permissions, secure infrastructure and operational controls.

No online service can guarantee absolute security. If an eligible data breach is likely to result in serious harm, we will assess and notify affected individuals and the Office of the Australian Information Commissioner where required by the Notifiable Data Breaches scheme.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, our legitimate operational needs, dispute handling and legal obligations. Investor data-room links are time-limited even where the underlying request record is retained for fundraising, diligence, legal or governance purposes. When information is no longer required, we take reasonable steps to delete or deidentify it unless the law requires retention.

13. Access, correction and account requests

You may request access to personal information Clea holds about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, subject to applicable law.

You can download a structured copy of available Clea account information through the My Data area. Clea also provides an experimental FHIR-aligned export for portability and interoperability development; it is not represented as a validated clinical-system integration.

You may also ask us to close your account or delete information where we are able to do so consistently with our legal and operational obligations.

Contact us at hello@cleamigraine.com.au.

14. Privacy complaints

If you have a privacy concern, contact hello@cleamigraine.com.au with enough information for us to investigate. We will respond within a reasonable period and explain the outcome or next steps.

If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner.

15. Changes to this policy

We may update this policy as Clea changes or legal requirements evolve. The current version and effective date will always be published on Clea.